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(57) Abstract 

An apparatus (10) is provided for classifying information or content servers on a communications network including the Internet. The 
apparatus (10) comprises means for obtaining one or more transmission characteristics of information on a path of said communications 
network and analysing means for predicting a classification of said information based on said one or more transmission characteristics. 
Typically said one or more transmission characteristics include any one or more of network protocol, date and time stamps, size of 
transmission activities (text and image), content type of transmission activities, pattern seen within the content of the transmission and 
any other characteristic that can be employed for predicting classifications. The apparatus (10) can be adapted toclassify user profiles in 
accordance with the predicted classification. A knowledge base of predetermined profiles can be included, and the analysing means is 
adapted to predict a classification based on a comparison between the profile of information to be classified and the predetermined profiles. 
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APPARATUS AND SYSTEM FOR CLASSIFYING AND 
CONTROL ACCESS TO INFORMATION 

TECHNICAL FIELD OF THE INVENTION 
THIS INVENTION relates to apparatus and system for classifying information 
5 on communications network and in particular but not limited to apparatus and 
system for classifying content servers and for selectively controlling access to 
classified content servers. 

BACKGROUND OF THE INVENTION 
The phenomenon growth of information technology has allowed many 
10 people to have access to diverse information on communications networks. The 
Internet in particular allows fetching of Information from any cooperating 
computers or content servers located in different parts of the world by simply 
clicking references to the information. As the number of accessible computers or 
content servers and the amount of information over the communications network 
1 5 grow daily it becomes increasingly difficult to classify them manually. 

Known systems for controlling the types of information accessible on a 
network rely on comparing a requested destination with those on pre-determined 
Access Control Lists (ACL) or on word matching to determine whether to allow or 
deny access. This approach can be applied at the client node prior to requesting the 
20 information or on any suitably intelligent network device capable of intercepting 
the request or subsequent reply prior to it reaching the requester. For example, in 
the case of an Internet browser running on a PC or work station, a request is made 
for an Internet resource such as a web site. A software program for monitoring such 
requests on the PC can be configured to scan a pre-determined list of site addresses 
25 for a match. If found, access to the site may be denied and a suitable message is 
then displayed informing the user that access is denied. Alternatively, the request 
may be allowed to proceed, but as data are received from the site they are scanned 
for checking a match with one or more sets of pre-determined words, word 
fragments or phrases. If a match is found the site is not displayed on the computer 
30 but instead there is shown a suitable message. Typically, this type of control 
software is installed on a PC or work station which does not have particularly strict 
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access privileges. The control software can be easily removed, disabled or 
otherwise circumvented and thereby defeating the control system. 

A network device capable of intercepting the request or reply to a request, 
such as a proxy server, may perform similar actions using the same methods of web 
5 site matching. This is usually maintained by a network administrator with strict 
access rights. Also, a network requiring clients to connect through the network 
device in order to access the network can have its content control enforced. This 
allows content control of multiple clients from one central point. 

While these known systems do provide some access control abilities, there 
10 are several disadvantages. A system based on word or phrase matching can only 
match text and it therefore would allow access to undesi red information comprising 
graphic images. Also, a single word may match a broad range of sites with quite 
different classes of information. As an example, when the word "sex" is used to 
match pornographic sites the system would also block access to other sites 
15 providing non offensive information such as articles on biology. 

A system based on an access control list of prohibited sites is much more 
selective. Access can only be denied when attempting to access the sites which are 
included in the lists. While a suitably large list could bar access to a great deal of 
undesirable information it is difficult to keep up to date due to the rapid increase 
20 in the number of new sites and removal of sites. 

The above systems also do not lend themselves to adaptation to other 
network protocols and services such as interactive chat, streaming video, email or 
encrypted data streams. Extending to different languages also poses a problem for 
globalisation of these systems. 
25 OBIECT OF THE INVENTION 

An object of the present invention is to alleviate or to reduce to a certain 
degree one or more of the above disadvantages. 

Another object of the present invention is provide an apparatus/system for 
classifying user profiles. 



30 
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SUMMARY OF THE INVENTION 
In one aspect therefor the present invention resides in an apparatus for 
classifying information on communications network. The apparatus comprises 
means for obtaining one or more transmission characteristics of information on a 

5 path of said communications network, and analysing means for predicting a 
classification of said information based on said one or more transmission 
characteristics. 

In a second aspect therefor the present invention resides in an apparatus for 
classifying content servers which are accessible on a communications network. The 

1 0 apparatus comprises means for obtaining one or more transmission characteristics 
of information provided by any of said content servers on a path of said 
communications network, and analysing means for predicting a classification of said 
information based on said one or more transmission characteristics. 

In a third aspect therefor the present invention resides in a computer 

15 program for classifying information which is accessible on a communications 
network. The program comprises means for obtaining one or more transmission 
characteristics of information on a path of said communications network, and 
analysing means for predicting a classification of said information based on said one 
or more transmission characteristics. 

20 In a fourth aspect therefor the present invention resides in a computer 

program for classifying content servers which are accessible on a communications 
network. The apparatus comprises means for obtaining one or more transmission 
characteristics of information provided by any of said content servers on a path of 
said communications network, analysing means for predicting a classification of 

25 said information based on said one or more transmission characteristics. 

In a fifth aspect therefor the present invention resides in an 
apparatus/computer program for classifying user profiles of users accessing 
information or content servers on a communications network. The 
apparatus/computer program comprises means for obtaining one or more 

30 transmission characteristics of information or information provided by any one of 
said content servers on a path of said communications network, analysing means 
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for predicting a classification of said information or said one content server based 
on said one or more transmission characteristics, and means for classifying user 
profile in accordance with the predicted classification. 

The above invention may also comprise means for storing said one or more 
5 transmission characteristics. 

Typically said one or more transmission characteristics include any one or 
more of network protocol, date and time stamps, size of transmission activities (text 
and image), content type of transmission activities, pattern seen within the content 
of the transmission and any other characteristic that can be employed for predicting 
10 classifications. 

In preference said one or more transmission characteristics are obtained from 
network packets or fragments thereof. 

It is also preferred that the analysing means includes profiling means for 
providing profiles of interactions based on said one or more transmission 
15 characteristics. Typically said profiling means is arranged to process said one or 
more transmission characteristics for providing any one or more of frequency of 
interaction, duration of interaction, duration of absence of interaction, patterns of 
transmission, average number of http links within an object of related sites, average 
number of like sites visited within a time frame, and statistics from said other 
20 characteristics, for forming interaction profiles. The analysing means can then use 
the profiles for predicting classifications. 

The invention may have a knowledge base of predetermined profiles, and 
the analysing means is adapted to predict a classification based on a comparison 
between the profile of information to be classified and predetermined profiles. 
25 Advantageously the invention may have means for updating the knowledge 

base so that the classification prediction may be enhanced following classifications. 

In order that the present invention can be more readily understood and be 
put into practical effect reference will now be made to the accompanying drawings 
which illustrate one preferred embodiment of the invention and wherein: 
30 BRIEF DESCRIPTION OF THE DRAWING 

Figure 1 is a schematic diagram of the apparatus according to the invention; 
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Figure 2 is a table of selected data of captured packets of a search engine 
using the apparatus shown in Figure 1; 

Figure 3 is a partial table of selected data of captured packets of a news web 
site using the apparatus shown in Figure 1; 
5 Figure 4 is a table of selected data of captured packets of an entertainment 

web site using the apparatus shown in Figure 1; 

Figure 5 is a table of selected data of captured packets of the web site of an 
e-commerce merchant using the apparatus shown in Figure 1; 

Figure 6 is a table of selected data of captured packets of the web site of 
10 another e-commerce merchant using the apparatus shown in Figure 1 ; 

Figure 7 is a table of selected data of captured packets of a pornography web 
site using the apparatus shown in Figure 1; 

Figure 8 is a table of selected data of captured packets of another 
pornography web site using the apparatus shown in Figure 1; 
15 Figure 9 is a table of model N1 results using the apparatus shown in Figure 

1; 

Figure 1 0 is a table of model N2 results using the apparatus shown in Figure 

1; 

Figure 1 1 is a table of model N3 results using the apparatus shown in Figure 

20 1;and 

Figure 12 is a table of classification prediction confidence levels using the 
apparatus shown in Figure 1. 

DESCRIPTION OF THE PREFERRED EMBODIMENT 
Referring initially to Figure 1 there is shown an apparatus 10 for classifying 
25 media or information flowing through a path of a communications network which 
in this case is the Internet. 

As can be seen, network traffic passing through the apparatus 1 0 is captured 
and analysed for providing statistics relating to interactions between two or more 
terminals (not shown). The captured traffic is first checked against a list of 
30 predetermined classifications to determine if it is known or unknown. 
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When the captured traffic is of an unknown classification, various nnodels 
(to be described more fully below) are applied to the data set in the captured traffic 
in order to predict the content classification. The models use parameters derived 
from a knowledge base of previously classified data sets and fitness with these 
5 parameters to determine the classification of the content of the newly captured 
traffic. Thus, the web site sending the captured traffic is now classified and is added 
to the list of known classifications. 

It should be noted that the embodiment of the apparatus 10 as described 
herein is for an analysis of transmission traffic using the HTTP protocol. The 
10 apparatus 10 according to the present invention is not restricted to HTTP, and 

is easily adaptable to analyse data carried within any networks using any known 
protocol. Examples of the protocols include FTP, SMTP, NNTP, etc. 

Following classification the captured data set is stored in the knowledge 
base. As the knowledge base expands, more data are used for the model 
15 parameters. This refines the apparatus and results in improved predictive 
performance. 

The sites that are deemed to include undesirable information are added to 
Access control lists (ACLs), The ACLs are used control the flow of content 
information between terminals. E.g. Undesired content information can be 
20 prevented from travelling further through the network by simply not forwarding it, 
or by replacing it, or by intercepting the request for such content information and 
modifying its destination. 

Classification of traffic from content servers are relatively static. On the other 
hand, user terminals that interact with these content servers are variable and their 
25 classifications are considered transient classifications. 

Whereas classifications of content servers form a model of the style of 
content residing on the server, transient classifications form a model of style of 
content being viewed by a user terminal, or content consumer. This in effect forms 
a behaviour profile of such a consumer. This profile can be used to tailor the 
30 content information to suit the consumer. 
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As mentioned earlier the apparatus 10 captures a set of observed data 
relating to a network interaction event, and provides a set of results indicating the 
classification of a resource or personality residing at each network node involved 
in the interaction. This is accomplished by applying various statistical models to a 

5 profile, and testing this against results obtained from profiles of known 
classifications. In this example of the invention this process is represented by the 
following formulas: 

X is an unknown profile to be classified; 

Profiles p1,p2,p3...pn are of known classifications; 
10 Models Ml,M2,M3...Mn are available to operate on these profiles; and 

C1,C2,C3...Cn are profile classifications. 

The population of a profile of classification CI, may be defined by the 

population of Ml (p). Ml (x) may be tested against the true population using any of 

the standard statistical hypothesis methods. 
1 5 A pre-determined set of media terminals of a classification are modelled by 

various models Ml, M2 Mn. Each model consists of an approach and a set of 

parameter, e.g linear regression, gradient and point of interception, so that for a 

single classification Ml(pl,p2 pn), M2(ql,q2 qn) .. Mn(rl,r2 .. rn) are used to 

model the population from the classification. The models may be based on 
20 mathematical structures, or arbitrary rules. 

The models are continually refined as more network traffic passes through 

the apparatus 10, thereby increasing the population space from which the 

classifications are computed. 

A terminal may be permanently or transitionally defined in relation to a 
25 classification. A transitionally defined terminal may move between classifications 

based on the fitness of the observed traffic to the models of the various 

classifications. 

Figures 2 to 8 are tables of selected data of traffic for testing the profile of 
data during a network interaction with a content server to determine if it contains 
30 media content of a pornographic nature. Assumption is made that profiles for 
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content servers contain a variable which is the average size of graphical images 
served. 

A normal distribution or similar non-deterministic probability distribution is 
then used to test the hypothesis that the profile belongs to a population classified 
5 as pornographic. In this example, the population of the classification may be 
defined by the population of N(a,b) where N is the image size and a and b are the 
mean and variance respectively, based on a normal distribution. The average and 
standard deviation derived from the observed samples is tested against the true 
population using standard statistical hypothesis methods. 
10 In some cases this approach may be broadened to encompass analysis of 

variance methods with multiple dependant variables, to model the characteristics 
of a site. Traditional ANOVA or regressive techniques may be applied to model the 
media content. 

A variety of traditional deterministic and non-deterministic models may be 
1 5 applied to determine the hypothesis of profile classification. These may be changed 
or upgraded continually depending on the level of predictive power found. The 
functionality of models used is not limited to, but can include simple rules-of- 
thumb, deterministic and non-deterministic probability models, or arbitrary 
calculations. 

20 The choice of model is primarily dictated by the predictive power of that 

model against the population in question. 

Figures 2 through 8 show examples of basic data set that can be gathered by 
observing network traffic of a typical interaction between a client browser and a 
web server. 

25 Figures 9 to 1 1 illustrate a simple classification model. This model looks at 

the size, content and relationships of objects being transmitted by a content server. 

The outcome of this model is to determine if the media being transmitted has 

pornographic content. 

Classification: pornographic 
30 Standard Model: 

Nl(a,b) 
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Where Nl is the image size, a and b are the mean and variance respectively, based 

on a normal distribution. 

N2(c,d) 

Where N2 is the ratio of text to graphics, c and d are the total size of the text and 
5 graphic objects respectively. 
N3(e) 

Where N3 is the count of word patterns matched from a list of pre-determined 
words, and e is the text of an object. 

Observed Samples are given in the tables shown in Figures 2 to 8. 
10 For model Nl shown in Figure 9, there is applied the normal distribution 

hypothesis test to the observed samples deriving the results. 

The result shows confidence to the 93% and 87% level for sites 6 and 7 
respectively, that the sites belong to a population of pornographic sites. The other 
samples give much lower confidence levels. 
1 5 For model N2 shown in Figure 1 0, a simple rule is used to test if the ratio is 

below a pre-determined threshold. The results show that sites 2, 4, 6 and 7 are 
within the threshold ratirig. 

For Model N3 shown in Figure 11, a simple rule is used to test if the 
number of words matching a list of patterns, exceeds a pre-determined threshold. 
20 The results show that sites 6 and 7 exceed the threshold. 

A weighting formula is then applied to derive a final result as shown in 
Figure 12. 

Therefore, using this example model, the apparatus 10 would predict that 
sites 6 and 7 are probably serving media with pornographic content, whereas sites 
25 1 through 5 probably are not. 

The attached appendix shows an example of the set of rules, constants and 
formulas which determine a confidence prediction based on logistic regression. The 
rules are defined using "Submodel" and "Model" components to define individial 
data points, and aggregated data points. These are then referred to in the 
30 "ProbabilityAnalyser" equations which use standard predictive formulas. 
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Whilst the above has been given by way of illustrative example of the 
present invention many variations and modifications thereto will be apparent to 
those skilled in the art without departing from the broad ambit and scope of the 
invention as herein set forth. 
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CLAIMS 

1. An apparatus for classifying information on communications network, the 
apparatus comprises means for obtaining one or more transmission characteristics 
of information on a path of said communications network, and analysing means for 
predicting a classification of said information based on said one or more 
transmission characteristics. 

2. An apparatus for classifying content servers which are accessible on a 
communications network, the apparatus comprises means for obtaining one or 
more transmission characteristics of information provided by any of said content 
servers on a path of said communications network, and analysing means for 
predicting a classification of said information based on said one or more 
transmission characteristics. 

3. A computer program for classifying information which is accessible on a 
communications network, the program comprises means for obtaining one or more 
transmission characteristics of information on a path of said communications 
network, and analysing means for predicting a classification of said information 
based on said one or more transmission characteristics. 

4. A computer program for classifying content servers which are accessible on 
a communications network, the apparatus comprises means for obtaining one or 
more transmission characteristics of information provided by any of said content 
servers on a path of said communications network, analysing means for predicting 
a classification of said information based on said one or more transmission 
characteristics. 

5. An apparatus for classifying user profiles of users accessing information or 
content servers on a communications network, the apparatus comprises means for 
obtaining one or more transmission characteristics of information or information 
provided by any one of said content servers on a path of said communications 
network, analysing means for predicting a classification of said information or said 
one content server based on said one or more transmission characteristics, and 
means for classifying user profile in accordance with the predicted classification. 
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6. A computer program for classifying user profiles of users accessing 
information or content servers on a communications network, the program 
comprises means for obtaining one or more transmission characteristics of 
information or information provided by any one of said content servers on a path 
of said communications network, analysing means for predicting a classification of 
said information or said one content server based on said one or more transmission 
characteristics, and means for classifying user profile in accordance with the 
predicted classification. 

7. The invention according to any one of claims 1 to 6 further comprising 
means for storing said one or more transmission characteristics. 

8. The invention according to any one of claims 1 to 7 wherein said one or 
more transmission characteristics include any one or more of network protocol, 
date and time stamps, size of transmission activities (text and image), content type 
of transmission activities, pattern seen within the content of the transmission and 
any other characteristic that can be employed for predicting classifications. 

9. The invention according to any one of claims 1 to 8 wherein said one or 
more transmission characteristics are obtained from network packets or fragments 
thereof. 

10. The invention according to any one of claims 1 to 9 wherein the analysing 
means includes profiling means for providing profiles of interactions based on said 
one or more transmission characteristics. 

11. The invention according to claim 10 said profiling means is arranged to 
process said one or more transmission characteristics for providing any one or more 
of frequency of interaction, duration of interaction, duration of absence of 
interaction, patterns of transmission, average number of http links within an object 
of related sites, average number of like sites visited within a time frame, and 
statistics from said other characteristics, for forming interaction profiles, and the 
analysing means is adapted to use the profiles for predicting classifications. 

12. The invention according to any one of claims 1 to 1 1 further comprising a 
knowledge base of predetermined profiles, and the analysing means is adapted to 
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predict a classification based on a comparison between the profile of information 
to be classified and predetermined profiles. 

1 3. The invention according to claim 1 2 further comprising means for updating 
the knowledge base so that the classification prediction can be enhanced fol lowing 
classifications. 
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Appendix 

# : 

#Body Text Word Ratio Models 
5 SubModel Param AllWordCount WordList AllWords 
SubModel Param AllWordCount Context BODY 
# ^ 

#Body Text Unique Word Ratio Models 
SubModel Param AllWordCountUnique WordList AllWords 
10 SubModel Param AllWordCountUnique Context BODY 
SubModel Param AllWordCountUnique Mode Distinct 
# 

#Meta Text Word Ratio Models 

SubModel Param AIIMetaWordCount WordList AllWords 
1 5 SubModel Param AIIMetaWordCount Context META 

# _ 

#Alternate Text Word Ratio Models 

SubModel Param AllAlternateWordCount WordList AllWords 
SubModel Param AllAlternateWordCount Context ALTERNATE 

20 # »— — 

#lmage models 

SubModel Param LargeGIFPictureCount Dimension 201 x 201 - 999 x 999 

SubModel Param LargeGIFPictureCount ImageType GIF 

SubModel Param ThumbnailGIFPictureCount Dimension 51 x 51 - 200 x 200 
25 SubModel Param ThumbnailGIFPictureCount ImageType GIF 

SubModel Param IconGIFPictureCount Dimension 5 x 5 - 50 x 50 

SubModel Param IconGIFPictureCount ImageType GIF 

SubModel Param AllGIFPictureCount ImageType GIF 

Model Exp LargeGIFPictureRatio RATIO(LargeGIFPictureCount, 
30 AllGIFPictureCount) 



Substitute Sheet (Rule 26) RO/AU 
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Model Exp ThumbnailGIFPictureRatio RATIO(ThumbnailGIFPictureCount, 
AllGIFPictureCount) 

Model Exp IconGIFPictureRatio RATIO(lconGIFPictureCount, 
5 AllGIFPictureCount) 

SubModel Param LargeJPEGPictureCount Dimension 201 x 201 - 999 x 999 

SubModel Param LargeJPEGPictureCount ImageType JPEG 

SubModel Param ThumbnailJPEGPictureCount Dimension 51 x51 - 200 x 200 

1 0 SubModel Param ThumbnailJPEGPictureCount ImageType JPEG 

SubModel Param IconJPEGPictureCount Dimension 5 x 5 - 50 x 50 
SubModel Param IconJPEGPictureCount ImageType JPEG 
SubModel Param AllJPEGPictureCount ImageType JPEG 
Model Exp LargeJPEGPictureRatio RATIOdargeJPEGPictureCount, 

15 AllJPEGPictureCount) 

Model Exp ThumbnailJPEGPictureRatio RATIO(ThumbnailJPEGPictureCount, 
AllJPEGPictureCount) 

Model Exp IconJPEGPictureRatio RATIO(lconJPEGPictureCount, 
AllJPEGPictureCount) 

20 # 

SubModel Param LowDepthGIFPictureCount Depth 2 - 4 
SubModel Param LowDepthGIFPictureCount ImageType GIF 
SubModel Param MediumDepthGIFPictureCount Depth 5 - 6 
SubModel Param MediumDepthGIFPictureCount ImageType GIF 

25 SubModel Param HighDepthGIFPictureCount Depth 7-16 

SubModel Param HighDepthGIFPictureCount ImageType GIF 

Model Exp LowDepthGIFPictureRatio RATIO(LowDepthGIFPictureCount, 

AllGIFPictureCount) 

Model Exp MediumDepthGIFPictureRatio 
30 RATIO(MediumDepthGIFPictureCount, AllGIFPictureCount) 



Substitute Sheet (Rule 26) RO/AU 
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Model Exp HighDepthGIFPictureRatio RATIO(HighDepthGIFPictureCount, 
AllGIFPictureCount) 

# 

5 SubModel Param LowDepthJPEGPictureCount Depth 2 - 7 

SubModel Param LowDepthJPEGPictureCount ImageType JPEG 
SubModel Param MediumDepthJPEGPictureCount Depth 8-15 
SubModel Param MediumDepthJPEGPictureCount ImageType JPEG 
SubModel Param HighDepthJPEGPictureCount Depth 16-36 
10 SubModel Param HighDepthJPEGPictureCount ImageType JPEG 

Model Exp LowDepthJPEGPictureRatio RATIO(LowDepthJPEGPictureCount, 
AllJPEGPictureCount) 

Model Exp MediumDepthJPEGPictureRatio 
RATIO(MediumDepthJPEGPictureCount, AllJPEGPictureCount) 
1 5 Model Exp HighDepthJPEGPictureRatio RATIO(HighDepthJPEGPictureCount, 
AllJPEGPictureCount) 

# 

#Links Out Models 

SubModel Param AllLinkOutCount IncludeLocal FALSE 

20 # 

SubModel Param AVSLinkOutCount Classification ADULTVERIFICATION 

SubModel Param AVSLinkOutCount IncludeLocal FALSE 

Model Exp AVSLinkOutRatio RATIO(AVSLinkOutCount, AllLinkOutCount) 

25 # begin porn.conf 

#Body Text Word Count Models 

SubModel Param PornExtraHardWordCount WordFile 

models/dictionary/porn/porn_words_extrahard.txt 

SubModel Param PornHardWordCount WordFile 
30 models/dictionary/porn/porn_words_hard.txt 
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SubModel Param PornMediumWordCount WordFile 
models/dictionary/porn/porn_words_medium.txt 
SubModel Param Porn Lite WordCount WordFile 

5 models/dictionary/porn/porn_words_lite.txt 

SubModel Param PornExtraLiteWordCount WordFile 

models/dictionary/porn/porn_words_extralite.txt 

# 

#Unique Body Text Word Count Models 

10 

SubModel Param PornExtraHardWordCountUnique WordFile 

models/dictionary/porn/porn_words_extrahard.txt 

SubModel Param PornExtraHardWordCountUnique Mode Distinct 

SubModel Param PornHardWordCountUnique WordFile 

1 5 models/dictionary/porn/porn_words_hard.txt 

SubModel Param PornHardWordCountUnique Mode Distinct 

SubModel Param PornMediumWordCountUnique WordFile 

models/dictionary/porn/porn_words_medium,txt 

SubModel Param PornMediumWordCountUnique Mode Distinct 

20 SubModel Param PornLiteWordCountUnique WordFile 
models/dictionary/porn/porn_words_lite,txt 
SubModel Param PornLiteWordCountUnique Mode Distinct 
SubModel Param PornExtraLlteWordCountUnique WordFile 
models/dictionary/porn/porn_words_extralite.txt 

25 SubModel Param PornExtraLlteWordCountUnique Mode Distinct 

# 

#Body Text Word Ratio Models 

Model Exp PornTextWordRatioExtraHard RATIO(PornExtraHardWordCount, 
All WordCount) 

30 Model Exp PornTextWordRatioHard RATIO(PornHardWordCount, 
All WordCount) 
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Model Exp PornTextWorclRatioMedium RAT10(PornMediumWordCounc, 
AllWordCount) 

Model Exp PornTextWordRatioLite RATIO(PornLiteWordCount, AllWordCount) 
5 Model Exp PornTextWordRatioExtraLite RATIO(PornExtraLiteWordCount, 
AllWordCount) 

# 

#Body Text Unique Word Ratio Models 
Model Exp PornTextWordRatioExtraHardUnique 
1 0 RATIO(PornExtraHardWordCountUnique, AllWordCountUnique) 
Model Exp PornTextWordRatioHardUnique 
RATIO(PornHardWordCountUnique, AllWordCountUnique) 

Model Exp PornTextWordRatioMediumUnique 
1 5 RATIO(PornMediunnWordCountUnique, AllWordCountUnique) 

Model Exp PornTextWordRatioLiteUnique RATIO(PornLiteWordCountUnique, 
AllWordCountUnique) 

Model Exp PornTextWordRatioExtraLiteUnique 
RATIO(PornExtraLiteWordCountUnique, AllWordCountUnique) 

20 # 

#Domain Word Count Models 

SubModel Param PornExtraHardDomainWordCount Context DOMAIN-NAME 
SubModel Param PornExtraHardDonnainWordCount WordFile 
models/dictionary/porn/porn_words_extrahard.txt 
25 SubModel Param PornHardDomainWordCount Context DOMAIN-NAME 
SubModel Param PornHardDomainWordCount WordFile 
models/di<:tionary/porn/porn_words_hard.txt 

SubModel Param PornMediumDomainWordCount Context DOMAIN-NAME 
SubModel Param PornMediumDomainWordCount WordFile 
30 models/dictionary/porn/porn_words_medium.txt 

SubModel Param PornLiteDomainWordCount Context DOMAIN-NAME 
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SubModel Param PornLiteDomainWordCount WordFile 
model s/d i cti onary/ porn/porn_words_l ite.txt 

SubModel Param PomExtraLiteDomainWordCount Context DOMAIN-NAME 
5 SubModel Param PomExtraLiteDomainWordCount WordFile 
models/dictionary/porn/porn_words_extral ite.txt 
# 

#Meta Text Word Count Models 

SubModel Param PornExtraHardMetaWordCount Context META 
10 SubModel Param PornExtraHardMetaWordCount WordFile 
models/dictionary/porn/porn_words_extrahard.txt 
SubModel Param PornHardMetaWordCount Context META 
SubModel Param PornHardMetaWordCount WordFile 
models/dictionary/porn/porn_words_hard.txt 

15 

SubModel Param PornMediumMetaWordCount Context META 
SubModel Param PornMediumMetaWordCount WordFile 
models/dictionary/porn/porn_words_medium.txt 
SubModel Param PornLiteMetaWordCount Context META 

20 SubModel Param PornLiteMetaWordCount WordFile 
models/dictionary/porn/porn_words_l ite.txt 
SubModel Param PornExtraLiteMetaWordCount Context META 
SubModel Param PornExtraLiteMetaWordCount WordFile 
models/dictionary/porn/porn_words_extral ite.txt 

25 # — — 

#Meta Text Word Ratio Models 

Model Exp PornMetaWordRatioExtraHard 

RATIO(PornExtraHardMetaWordCount, AllMetaWordCount) 

Model Exp PornMetaWordRatioHard RATIO(PornHardMetaWordCount, 

30 Al IMetaWordCount) 
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Model Exp PornMetaWordRatioMedium RATIO(PornMediumMetaWordCount, 
AIIMetaWordCount) 

Model Exp PornMetaWordRatioLite RATIO(PornLiteMetaWordCount, 
5 AIIMetaWordCount) 

Model Exp PornMetaWordRatioExtraLite RATIO(PornExtraLiteMetaWordCount, 
AIIMetaWordCount) 

# 

#Alternate Text Word Count Models 
10 SubModel Param PornExtraHardAlternateWordCount Context ALTERNATE 

SubModel Param PornExtraHardAlternateWordCount WordFile 

nnodels/dictionary/porn/porn_words_extrahard.txt 

SubModel Param PornHardAlternateWordCount Context ALTERNATE 

SubModel Param PornHardAlternateWordCount WordFile 
1 5 models/dictionary/porn/porn_words_hard.txt 

SubModel Param PornMediumAlternateWordCount Context ALTERNATE 

SubModel Param PornMediumAlternateWordCount WordFile 

models/djctionary/porn/porn_words_medium.txt 

SubModel Param PornLiteAlternateWordCount Context ALTERNATE 
20 SubModel Param PornLiteAlternateWordCount WordFile 

models/dictionary/porn/porn_words_lite.txt 

SubModel Param PornExtraLiteAlternateWordCount Context ALTERNATE 
SubModel Param PornExtraLiteAlternateWordCount WordFile 
models/dictionary/porn/porn_words_extralite.txt 

25 # 

#Alternate Text Word Ratio Models 

Model Exp PornAlternateWordRatioExtraHard 

RATIO(PornExtraHardAlternateWordCount, AllAlternateWordCount) 
Model Exp PornAlternateWordRatioHard RATIO(PornHardAlternateWordCount, 
30 AllAlternateWordCount) 
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Model Exp PornAlternateWordRatioMedium 

RATIO(PornMediumAlternateWordCount, AllAlternateWordCount) 
Model Exp PornAlternateWordRatioLite RATIO{PornLiteAlternateWordCount, 
5 AllAlternateWordCount) 

Model Exp PornAlternateWordRatioExtraLite 
RATIO(PornExtraLiteAlternateWordCount, AllAlternateWordCount) 
# 

#Llnks Out Models 
10 SubModel Param PornLinkOutCount Classification PORN 
SubModel Param PornLinkOutCount IncludeLocal FALSE 
Model Exp PornLinkOutRatio RATIO(PornLinkOutCount, AllLinkOutCount) 
# 

#Logistic Models 
1 5 Model Exp PornLRConstant -3.9869 
# 

Model Exp PornLRCoefficientPornTextWordRatioExtraHard 39.7450 

Model Exp PornLRCoefficientPornTextWordRatioHard 355.0550 

20 Model Exp PornLRCoefficientPornTextWordRatioMedium -1 36.436 
Model Exp PornLRCoefficientPornTextWordRatioLite -63.2565 
Model Exp PornLRCoefficientPornTextWordRatioExtraLite 33.9054 
# 

Model Exp PornLRCoefficientPornTextWordRatioExtraHardUnique 111.4752 
25 Model Exp PornLRCoefficientPornTextWordRatioHardUnique -72.7005 

Model Exp PornLRCoefficientPornTextWordRatioMediumUnique 264.1902 
Model Exp PornLRCoefficientPornTextWordRatioLiteUnique 125.0743 
Model Exp PornLRCoefficientPornTextWordRatioExtraLiteUnique -16.6895 
# 

30 Model Exp PornLRCoefficientPornExtraHardDomainWordCount 0.2598 
Model Exp PornLRCoefficientPornHardDomainWordCount 2.1344 
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Model Exp PornLRCoefficientPornMediumDomainWordCount 0 
Model Exp PornLRCoefficientPornLiteDomainWordCount 0.0610 
Model Exp PornLRCoefficientPornExtraLiteDomainWordCount 0 
5 # 

Model Exp PornLRCoefficientPornMetaWordRatioExtraHard 0 
Model Exp PornLRCoefficientPornMetaWordRatioHard 0 
Model Exp PornLRCoefficientPornMetaWordRatioMedium 0 
Model Exp PornLRCoefficientPornMetaWordRatioLite 0 
10 Model Exp PornLRCoefficientPornMetaWordRatioExtraLite 0 
# 

Model Exp PornLRCoefficientPornAlternateWordRatioExtraHard 16.1972 
Model Exp PornLRCoefficientPornAlternateWordRatioHard 0 
Model Exp PornLRCoefficientPornAlternateWordRatioMedium 26.4186 
1 5 Model Exp PornLRCoefficientPornAlternateWordRatioLite 0 

Model Exp PornLRCoefficientPornAlternateWordRatioExtraLite 14.1615 
# 

Model Exp PornLRCoefficientAllGIFPictureCount 0 
Model Exp PornLRCoefficientLargeGIFPictureCount 0 

20 

Model Exp PomLRCoefficientlconGIFPictureCount 0 
Model Exp PornLRCoefficientThumbnailGIFPictureCount 0 
Model Exp PornLRCoefficientLargeGIFPictureRatio 0 
Model Exp PornLRCoefficientlconGIFPictureRatio 0 

25 Model Exp PornLRCoefficientThumbnailGIFPictureRatio 0 
Model Exp PornLRCoefficientHighDepthGIFPictureCount 0 
Model Exp PornLRCoefficientMediumDepthGIFPictureCount 0 
Model Exp PornLRCoefficientLowDepthGIFPictureCount 0 
Model Exp PornLRCoefficientHighDepthGIFPictureRatio 0 

30 Model Exp PornLRCoefficientMediumDepthGIFPictureRatio 0 
Model Exp PornLRCoefficientLowDepthGIFPictureRatio 0 
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Model Exp PornLRCoefficientAllJPEGPictureCount 0 
Model Exp PornLRCoefficientLargeJPEGPictureCount 0 
5 Model Exp PornLRCoefflcientlconJPEGPictureCount 0 

Model Exp PornLRCoefflcientThumbnailjPEGPIctureCountO 
Model Exp PornLRCoefflcientLargeJPEGPictureRatIo 0 
Model Exp PornLRCoefflcientlconJPEGPictureRatio 0 
Model Exp PornLRCoefflcientThumbnailJPEGPictureRatio 0 

10 Model Exp PornLRCoefflcientHlghDepthJPEGPictureCount 0 

Model Exp PornLRCoefficientMediumDepthJPEGPictureCount 0 
Model Exp PornLRCoefflcientLowDepthJPEGPictureCount 0 
Model Exp PornLRCoefficientHighDepthJPEGPictureRatio 0 
Model Exp PornLRCoefficientMediumDepthjPEGPictureRatio 0 

1 5 Model Exp PornLRCoefflcientLowDepthJPEGPictureRatio 0 
# 

Model Exp PornLRCoefflcientPornLinkOutRatio 4.6958 
Model Exp PornLRCoefficlentAVSLinkOutCount 0.3327 
Model Exp PornLRCoefflcientAVSLinkOutRatio 3.6786 

20 # 

Model Exp PornLRLogOdds SUM(PornLRConstant, \ 

PRODUCT(PornLRCoefficientPornTextWordRatloExtraHard, 
PornTextWordRatioExtraHard), \ 

PRODUCT(PornLRCoefflcientPornTextWordRatioHard, 
25 PornTextWordRatioHard), \ 

PRODUCKPornLRCoefficientPornTextWordRatioMedium, 
PornTextWordRatioMedium), \ 

PRODUCKPornLRCoefficientPornTextWordRatloLlte, 
PornTextWordRatloLite), \ 
30 PRODUCKPornLRCoefficientPornTextWordRatioExtraLite, 
PornTextWordRatioExtraLlte), \ 
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PRODUCKPornLRCoefficientPornTextWordRatioExtraHardUnique, 
PornTextWordRatioExtraHardUnique), \ 

PRODUCT(PornLRCoefficientPornTextWordRatioHardUnique, 
5 PornTextWordRatioHardUnique), \ 

PRODUCT(PornLRCoefficientPornTextWordRatioMediumUnique, 
Por nText Word Rati oMed i u m U n i q ue), \ 

PRODUCT(PornLRCoefficientPornTextWordRatioLiteUnique, 
PornTextWordRatioLiteUnique), \ 
10 PRODUCT(PornLRCoefficientPornTextWordRatioExtraLiteUnique, 
PornTextWordRatioExtraLiteUnique), \ 

PRODUCT(PornLRCoefficientPornExtraHardDomainWordCount, 
PornExtraHardDomainWordCount), \ 

PRODUCT(PornLRCoefficientPornHardDomainWordCount, 
1 5 PornHardDomainWordCount), \ 

PRODUCT{PornLRCoefficientPornMediumDomainWordCount, 
PornMediumDomainWordCount), \ 

PRODUCT(PornLRCoefficientPornLiteDomainWordCount, 
PornLiteDomainWordCount), \ 
20 PRODUCKPornLRCoefficientPornExtraLiteDomainWordCount, 
PornExtraLiteDomainWordCount), \ 

PRODUCKPornLRCoefficientPornMetaWordRatioExtraHard, 
PornMetaWordRatioExtraHard), \ 

PRODUCKPornLRCoefficientPornMetaWordRatioHard, 
25 PornMetaWordRatioHard), \ 

PRODUCT(PornLRCoefficientPornMetaWordRatioMedium, 
PornMetaWordRatioMedium), \ 

PRODUCKPornLRCoefficientPornMetaWordRatioLite, 
PornMetaWordRatioLite), \ 
30 PRODUCT(PornLRCoefficientPornMetaWordRatioExtraLite, 
PornMetaWordRatioExtraLite), \ 
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PRODUCKPornLRCoefficientPornAlternateWordRatioExtraHard, 

PornAlternateWordRatioExtraHard), \ 

PRODUCKPornLRCoefficientPornAlternateWordRatioHard, 

5 PornAlternateWordRatioHard), \ 

PRODUCKPornLRCoefficientPornAlternateWordRatioMedium, 

PomAlternateWordRatioMedium), \ 

PRODUCT{PomLRCoefficientPornAlternateWordRatioLite, 

PornAlternateWordRatioLite), \ 
1 0 PRODUCKPornLRCoefficientPornAlternateWordRatioExtraLite, 

PornAlternateWordRatioExtraLite), \ 

PRODUCT(PornLRCoefficientAllGIFPictureCount, AllGIFPictureCount), \ 
PRODUCKPornLRCoefficientLargeGIFPictureCount, 

LargeGIFPictureCount), \ 
1 5 PRODUCT(PornLRCoefficientlconGIFPictureCount, 

IconGIFPictureCount), \ 

PRODUCT{PornLRCoefficientThumbnailGIFPictureCount, 

ThumbnailGIFPictureCount), \ 

PRODUCKPornLRCoefficientLargeGlFPictureRatio, 

20 LargeGlFPictureRatio), \ 

PRODUCKPornLRCoefficientlconGIFPictureRatio, IconGlFPictureRatio), \ 
PRODUCKPornLRCoefficientThumbnailGIFPictureRatio, 

ThumbnailGIFPictureRatio), \ 

PRODUCKPornLRCoefficientHighDepthGIFPictureCount, 

25 H i ghDepthG IF Pi ctu recount), \ 

PRODUCKPornLRCoefficientMediumDepthGIFPictureCount, 

MediumDepthGIFPictureCount), \ 

PRODUCKPornLRCoefficientLowDepthGlFPictureCount, 

LowDepthGIFPictureCount), \ 
30 PRODUCT(PornLRCoefficientHighDepthGIFPictureRatio, 

HighDepthGIFPictureRatio), \ 
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PRODUCKPornLRCoefficientMediumDepthGIFPictureRatio, 

MediumDepthGIFPictureRatio), \ 

PRODUCKPornLRCoefficientLowDepthGIFPictureRatio, 

LowDepthGIFPictureRatio), \ 

PRODUCKPornLRCoefficientAllJPEGPictureCount, AllJPEGPictureCount), 

\ 

PRODUCKPornLRCoefficientLargeJPEGPictureCount, 

LargeJPEGPictureCounl), \ 

PRODUCKPornLRCoefficientlconJPEGPictureCount, 

IconJPEGPictureCount), \ 

PRODUCT(PornLRCoefficientThumbnailJPEGPictureCount, 

ThumbnailJPEGPictureCount), \ 

PRODUCT(PornLRCoefficientLargeJPEGPictureRatio, 

LargeJPEGPictureRatio), \ 

PRODUCKPornLRCoefficientlconJPEGPictureRatio, 

IconJPEGPictureRatio), \ 

PRODUCT(PornLRCoefficientThumbnailJPEGPictureP.atio, 

ThumbnailJPEGPictureRatio), \ 

PRODUCKPornLRCoefficientHighDepthJPEGPictureCount, 

HighDepthJPEGPictureCount), \ 

PRODUCKPornLRCoefficientMediumDepthJPEGPictureCount, 

MediumDepthjPEGPictureCount), \ 

PRODUCKPornLRCoefficientLowDepthJPEGPictureCount, 

LowDepthjPEGPictureCount), \ 

PRODUCKPornLRCoefficientHighDepthJPEGPictureRatio, 

HighDepthJPEGPictureRatio), \ 

PRODUCKPornLRCoefficientMediumDepthJPEGPictureRatio, 

MediumDepthJPEGPictureRatio), \ 

PRODUCT(PornLRCoefficientLowDepthJPECPictureRatio, 

LowDepthJPEGPictureRatio), \ 
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PRODUCKPornLRCoefficientPornLinkOutRatio, PornLinkOutRatio), \ 
PRODUCT(PornLRCoefficientAVSLinkOutCount, AVSLinkOutCount), \ 
PRODUCKPornLRCoefficientAVSLinkOutRatio, AVSLinkOutRatio)) 
5 # — 

#Probability Analysers 

ProbabilityAnalyser Param PornAltMetaWordCountProbability Classification 
PORN 

ProbabilityAnalyser Exp PornAltMetaWordCountProbability \ 
10 SUM(PornExtraHardMetaWordCount, PornHardMetaWordCount, \ 

PRODUCT(0.5,PornMediumMetaWordCount), \ 
PornExtraHardAlternateWordCount, 
PornHardAlternateWordCount, \ 

PRODUCT{0.5,PornMediumAlternateWordCount)) 
15 ProbabilityAnalyser Param PornMetaWordRatioProbability Classification PORN 
ProbabilityAnalyser Exp PornMetaWordRatioProbability \ 

PRODUCTdOO, SUM(PornMetaWordRatioExtraHard, \ 

PornMetaWordRatioHard, PornMeta Word Rati oMedium)) 
ProbabilityAnalyser Param PornLRProbability Classification PORN 
20 ProbabilityAnalyser Exp PornLRProbability PRODUCTdOO, 
RATIOd ,SUM(1 ,EXP(MIN US(PornLRLogOdds))))) 
# 
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Object 



Rit e 1 Objects - Content Type "Search Engine" 

Destination 



Source 





IP Address 


Port 


1 


202.139.16.45 


63450 


2 


204.71.200.72 


80 


3 


202.139.16.45 


63450 


4 


202.139.16.45 


63450 


5 


202.139.16.45 


63450 


6 


204.71.200.72 


80 


7 


204.71.200.72 


80 


8 


204.71.200.72 


80 


9 


202.139.16,45 


63450 


10 


204.71.200.72 


80 


11 


202.139.16.45 


63450 


12 


204.71.200.72 


80 


13 


202.139.16.45 


63450 


14 


202.139.16.45 


63450 


15 


202.139.16.45 


63450 


16 


204.71 .200.72 


80 


17 


202.139.16.45 


63450 


18 


204.71.200.72 


80 


19 


202.139.16.45 


63450 


20 


204.71 .200.72 


80 


21 
22 


204.71.200.72 
204.71.200.72 


80 
80 



IP Address 



204.71.200.72 
202.139.16.45 
204.71 .200.72 
204.71.200.72 
204.71.200.72 
202.139.16.45 
202.139.16.45 
202.139.16.45 
204.71.200.72 
202.139.16.45 
204.71.200.72 
202.139.16.45 
204.71.200.72 
204.71 .200.72 
204.71 .200.72 
202.139.16.45 
204.71.200.72 
202.139.16.45 
204.71 .200.72 
202.139.16.45 
202.139.16.45 
202.139.16.45 



Port 



80 
63450 
80 
80 
80 
63450 
63450 
63450 
80 
63450 
80 
63450 
80 
80 
80 
63450 
80 
63450 
80 
63450 
63450 
63450 



Type 



GET 
text/html 
GET 
GET 
GET 

image/gif 

image/gif 

image/gif 

GET 

text/html 

GET 

image/gif 

GET 

GET 

GET 

image/gif 

GET 

image/gif 

GET 

image/gif 

Image./gif 

image/gif 



Size 



36 
9424 
79 
46 
50 
2637 
4672 
357 
56 
11193 
59 
11522 
67 
67 
59 
1398 
76 
1728 
69 
962 
946 
1716 



Timestamp 



14:53:17 
14:53:17 
14:53:19 
14:53:19 
14:53:19 
14:53:19 
14:53:20 
14:53:20 
14:53:27 
14:53:28 
14:53:29 
14:53:29 
14:53:30 
14:53:30 
14:53:30 
14:53:30 
14.53:30 
14:53:30 
14:53:30 
14:53:30 
14:53:31 
14:53:31 
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1 
2 
3 
4 
5 
6 
7 
8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 
29 
30 

•31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 



iP Address 
202.139.16.45 
165:69.1.187 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16-45 
202.139.16.45 
202.139.16.45 
165.69.1.187 
165.69-1.187 
165.69.1-187 
165.69.1.187 
165.69.1.187 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
202.139.16.45 
165.69.1.187 
165.69.1.187 
202-139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1,187 
202.139.16.45 
202.139.16.45 
165.69.1.187 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139-16.45 
202-139.16.45 
202.139.16.45 
202.139.16.45 
165.69.1.187 
165-69.1.187 
,165.69.1.187 
165.69.1.187 



63450 
80 
63450 
63450 
63450 
63450 
63450 
63450 
80 
80 
80 
80 
80 
80 
63450 
80 
63450 
80 
63450 
63450 
80 
80 
63450 
80 
63450 
80 
63450 
80 
63450 
63450 
80 
80 
63450 
80 
63450 
63450 
63450 
63450 
80 
80 
80 
80 



i P Address 

65.69.1.187 
202.139.16.45 
65.69.1.187 
65.69.1.187 
65.69.1.187 
65.69.1.187 
65.69.1.187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
165.69.1.187 
202.139-16.45 
165.69,1-187 
165.69.1-187 
165.69.1-187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 



Port_ 

80 
63450 
80 
80 
80 
80 
80 
80 
63450 
63450 
63450 
63450 
63450 
63450 
80 
63450 
80 
63450 
80 
80 
63450 
63450 
80 
63450 
80 
63450 
80 
63450 
80 
80 
63450 
63450 
80 
63450 
80 
80 
80 
80 
63450 
63450 
63450 
63450 



Type 
GET 
text/html 
GET 
GET 
GET 
GET 
GET 
GET 
text/html 
text/html 
text/html 
text/html 
text/html 
text/htmi 
GET 
image/gif 
GET 

image/gif 
GET 

GET 
image/gif 
image/gif 
GET 
image/gif 
GET 
mage/git 
GET 
image/gif 
GET 
GET 
unknown 
image/gif 
GET 
image/gif 
GET 
GET 
GET 
GET 

image/gif 
image/gif 
image/gif 
image/gif 



38 
2312 
52 
56 
46 
48 
47 
47 
333 
56 
2445 
202 
202 
56 
71 
1229 
64 
43 
64 
64 
43 
43 
67 
2442 
73 
1364 
71 
8942 
71 
65 
10 
15550 
77 
4732 
70 
70 
68 
68 
436 
405 
436 
405 



Timestam ] 
14:54:04 
14:54:04 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:06 
14:54:06 
14:54.06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54.07 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
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Site 2 Objects - Content Type "News" 



Source 



Port 



IP Address 



Destination 



Port 



GET 
text/html 
GET 
GET 
GET 
GET 
GET 
GET 
text/html 
text/html 
text/html 
text/html 
text/htm! 
text/htmJ 
GET 
image/gif 
GET 

image/gif 
GET 

GET 

image/gif 
image/gif 
GET 
image/gif 
GET 
image/gif 
GET 
image/gif 
GET 
GET 
unknown 
image/gif 
GET 
image/gif 
GET 
GET 
GET 
GET 
image/gif 
image/gif 
image/gif 
image/gif 



Size 



Timestamp 
04 



1 


202.139.16.45 


63450 


2 


165:69.1.187 


80 


3 


202.139.16.45 


63450 


4 


202.139.16.45 


63450 


5 


202.139.16.45 


63450 


\j 


202.139.16-45 


63450 


7 


202.139.16.45 


63450 


8 


202.139.16.45 


63450 


9 


165.69.1.187 


80 


10 


165.69-1.187 


80 


-| 1 


165 69.1.187 


80 


12 


165.69.1.187 


80 


13 


165.69.1.187 


80 


14 


165.69-1.187 


80 


15 


202.139.16.45 


63450 


16 


165.69.1.187 


80 


17 


202.139.16.45 


63450 


18 


165.69.1.187 


80 


19 


202.139.16.45 


63450 


20 


202.139.16.45 


63450 


21 


165.69.1.187 


80 


22 


165.69.1,187 


80 


23 


202-139.16.45 


63450 


24 


165.69.1.187 


oU 


25 


202.139.16.45 


63450 


26 


165.69.1. 187 


80 


27 


202.139.16.45 


63450 


28 


165.69,1.187 


80 


29 


202-139.16.45 


63450 


30 


202.139.16.45 


63450 


•31 


165.69.1.187 


80 


32 


165.69.1.187 


80 


33 


202-139.16.45 


63450 


34 


165.69.1.187 


80 


35 


202.139.16.45 


63450 


36 


202.139.16.45 


63450 


37 


202.139.16.45 


63450 


38 


202.139.16.45 


63450 


39 


165.69.1.187 


80 


40 


165.69.1.187 


80 


41 


165.69.1.187 


80 


42 


165.69.1.187 


80 



165.69.1.187 
165.69.1.187 
165.69.1.187 
165.69.1.187 
165.69.1.187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
202.139.16.45 
165.69.1.187 
202.139,16.45 
165.69.1-187 
202.139.16.45 
165.69-1-187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
165-69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69-1.187 
165.69.1.187 
202.139.16.45 
202.139.16.45 
165.69.1.187 
202.139.16.45 
165.69.1-187 
165.69.1.187 
165.69.1.187 
165.69.1.187 
202.139,16.45 
202.139-16.45 
202-139.16.45 
202.139.16.45 



80 
63450 
80 
80 
80 
80 
80 
80 
63450 
63450 
63450 
63450 
63450 
63450 
80 
63450 
80 
63450 
80 
80 
63450 
63450 
80 
63450 
80 
63450 
80 
63450 
80 
80 
63450 
63450 
80 
63450 
80 
80 
80 
80 
63450 
63450 
63450 
63450 



38 
2312 
52 
56 
46 
48 
47 
47 
333 
56 
2445 
202 
202 
56 
71 
1229 
64 
43 
64 
64 
43 
43 
67 
2442 
73 
1364 
71 
8942 
71 
65 
10 
15550 
77 
4732 
70 
70 
68' 
68 
436 
405 
436 
405 



4:54: 
14:54:04 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:05 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:06 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:07 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:08 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
14:54:09 
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Site 3 Object 


s - Content Type "Entertain men 


t" 






Source 


Destination 








Object 


IP Address 


Port 


IP Address 


Port 


Type 


Size 


Timestamp 


1 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


40 


14:55:10 


2. 


204.202.129.23 


80 


202.139.16.45 


63450 


text/ntml 


56 


14:55:11 


o 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


39 


14:55:11 


4 


204.202.129.23 


80 


202.139.16.45 


63450 


text/html 


25765 


14:55:12 


5 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


58 


14:55:13 


6 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


66 


14:55:13 


7 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


62 


14:55:13 


8 


204.202.129.23 


80 


202.139.16.45 


63450 


image/jpec 


5277 


14:55:14 


9 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


43 


14:55:14 


10 


204.202.129,23 


80 


202.139.16.45 


63450 


image/gif 


1266 


14:55:14 


11 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


63 


14:55:20 


12 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


58 


14:55:21 


13 


202.139,16.45 


63450 


204.202.129.23 


80 


GET 


72 


14:55:21 


14 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 




14:55:22 


15 


204.202.129.23 


80 


202.139.16.45 


63450 


Image/gif 




14:55:22 


16 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


*T 1 *T 


1 *-r.OO.^^ 


17 


202.139.16.45 


63450 


204.202.129.23, 


80 


GET 






18 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 




14:55:22 


19 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


406 


14:55:22 


20 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


74fi 


14:55:22 


21 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 




14:55:23 


22 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 




1 ^.oo .^o 


23 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 


DO 


I *+ .OO .^O 


24 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 




1 M-.OO .£~%J 


25 


204.202.129.23 


80 


202,139.16.45 


63450 


image/gif 


1 uuo 


14:55:23 


26 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


OO 


14:55:24 


27 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


906 


14:55:24 


28 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


447 


14:55:24 


29 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 


67 


14:55:24 


30 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


58 


14:55:24 


31 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


62 


14:55:24 




204.202.129.23 


80 


202.139.16.45 


63450 


image/jpeg 


7861 


14:55:24 


OO 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


391 


14:55:25 


O^ 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


641 


14:55:25 


oO 


202.139.16.45 


63450 


204.202.129.23 


80 


Cat 1 


57 


14:55:25 


OD 


204.202.129.23 


80 


202.139.1 6.45 


C n y« cn 

Do45U 


image/gif 


377 


14:55:25 


O / 


^U^. 1 Oa. ID-M-O 


63450 


204.202.129.23 


80 




60 


14:55:26 


OO 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


78 


14:55:26 


39 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


74 


14:55:26 


40 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


67 


14:55:26 


41 


204.202,129.23 


80 


202.139.16.45 


63450 


image/gif 


403 


14:55:26 


42 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


1796 


14:55:26 


43 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


6845 


14:55:27 


44 


202.139.16.45 


63450 


204.202.129.23 


80 


GET 


56 


14:55:27 


45 


204.202.129.23 


80 


202.139.16.45 


63450 


image/jpeg 


17796 


14:55:27 


46 


202.139.16.45 


63450 


204.202.129.23; 


80 


GET 


56 


14:55:27 


47 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


49 


14:55:27 


48 


204.202.129.23 


80 


202.139.16.45 


63450 


image/gif 


44 


14:55:27 



FIG. A- 
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Site 4 Objects - Content Type "Computer Hardvvare" 



Object 



Source 



IP Address 



Port 





Destinati 


on 


Type 


Size 


1 imesiamp 


I 


IP Address 


Port 


63450 


209.143.240.6 


80 


GET 


34 


14.0O.4y 


80 


202.139.16.45 


63450 


text/html 


1645 


14:55.50 


63450 


209.143.240.6 


80 


GET 


47 


14:55:51 


80 


202.139.16.45 


63450 


text/html 


56 


14:55:51 


63450 


209.143.240.6 


80 


GET 


64 


14:55:53 


63450 


209.143.240.6 


80 


GET 


63 


14:55:53 


63450 


209.143.240.6 


80 


GET 


63 


14:55:53 


80 


202.139.16.45 


63450 


image/gif 


290 


14:55:53 


63450 


209.143.240.6 


80 


GET 


64 


14:55:54 


80 


202.139,16.45 


63450 


image/gif 


403 


14:55:54 


80 


202.139.16.45 


63450 


image/gif 


381 


14:55:54 


63450 


209.143.240,6 


80 


GET 


63 


14:55:54 


63450 


209.143.240.6 


80 


GET 


65 


14:55:54 


80 


202.139.16.45 


63450 


image/gif 


348 


14:55:54 


63450 


209.143.240.6 


80 


GET 


65 


1 4:55:54 


63450 


209.143.240.6 


80 


GET 


65 


1 4.0D.04 


80 


202.139.16.45 


63450 


image/gif 


354 


1 4.00.04 


80 


202.139.16.45 


63450 


image/gif 


con 
bUU 


I 4.00.D<+ 


63450 


209.143.240.6 


80 


GET 


DO 




63450 


209.143-240.6 


80 


c "I" 






80 


202.139-16,45 


bd4oU 


image/yu 


4Q0 


14*55*55 


63450 


209.143.240.6 


oU 


ot 1 




14-55-55 


80 


202. I oy.i b.4D 




im a no /n if 


571 


14:55:55 


80 






i m i3 n o /n i f 


322 


14:55:55 


ou 




63450 


image/gif 


571 


14:55:55 


63450 


209.143.240.6 


80 


GET 


55 


14.55:55 


80 


202.139.16.45 


63450 


image/gif 


363 


14:55:55 


63450 


209.143.240.6 


80 


GET 


63 


14:55:55 


63450 


209.143-240.6 


80 


GET 


63 


14:55:55 


63450 


209.143.240.6 


80 


GET 


62 


14:55:55 


80 


202.139.16.45 


63450 


image/gif 


241 


14:55:56 


63450 


209,143.240.6 


80 


GET 


59 


14:55:56 


80 


202.139.16.45 


63450 


image/gif 


488 


14:55:56 


80 


202.139.16.45 


63450 


image/gif 


463 


14:55:56 


63450 


209.143-240.6 


80 


GET 


59 


14:55:56 


80 


202.139.16.45 


63450 


image/gif 


714 


14:55:56 


63450 


209.143.240.6 


80 


GET 


53 


14:55:56 


80 


202.139.16-45 


63450 


image/gif 


35 


14:55:56 


63450 


209-143.240.6 


80 


GET - 


53 


14:55:56 


80 


202.139.16.45 


63450 


image/gif 


1188 


14:55:56 


63450 


209.143.240.6 


80 


GET 


54 


14:55:56 


80 


202.139.16.45 


63450 


image/gif 


327 


14:55:57 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 



202.139- 
209.143 
202.139 
209.143. 
202.139 
202.139 
202.139 
209-143. 
202.139. 
209.143. 
209.143. 
202.139. 
202.139- 
209.143. 
202.139 
202.139. 
209.143 
209.143 
202.139 
202.139 
209.143 
202.139. 
209.143 
209.143 
209.143 
202.139 
209.143 
202.139 
202.139 
202.139 
209.143 
202.139 
209.143 
209.143 
202.139 
209.143 
202.139 
209.143 
202.139 
209.143 
202.139 
209.143 



16,45 
240.6 
16.45 
240.6 
16.45 
16.45 
16.45 
240.6 
16.45 
240.6 
.240.6 
16.45 
16.45 
240.6 
16.45 
16.45 
240.6 
240.6 
16.45 
16.45 
240,6 
16.45 
.240.6 
,240.6 
.240-6 
.16.45 
.240.6 
.16.45 
.16-45 
.16.45 
.240.6 
.16.45 
.240.6 
.240-6 
.16.45 
240-6 
.16,45 
240.6 
.16.45 
.240.6 
.16.45 
.240.6 
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Object 



Site 5 Objects - 



Content Type ^'Computer Software" 



Source 



IP Address 



Port 



1 202.139.16.45 

2 207.46.130.149 

3 202.139.16.45 

4 207.46.130.149 

5 202.139.16.45 

6 207.46.130.149 

7 202.139.16.45 

8 207,46.130.149 

9 202.139.16.45 

10 202,139.16.45 

11 202.139.16.45 

12 202.139.16.45 

13 207.46.130.149 

14 202.139.16.45 

15 207.46.130.149 

16 207.46.130-149 

17 207.46.130.149 

18 202.139.16.45 

19 207.46.130.149 

20 207.46.130.149 

21 202.139.16.45 

22 207.46.130.149 

23 202.139.16.45 

24 202.139.16.45 

25 202.139.16.45 

26 202.139.16-45 

27 207.46.130.149 

28 207.46.130.149 

29 207.46.130.149 

30 207.46.130.149 

31 202.139.16.45 

32 207.46.130.149 



Destination 



IP Address Port 
634501207 46.130.149 

80 202.139.16.45 
63450 207.46.130.149 

80 202.139.16.45 
63450 207.46.130.149 

80 202.139.16.45 
63450 207.46.130.149 

80 202.139.16.45 
63450 207.46.130.149 
63450 207.46.130.149 
63450 207.46.130-149 
63450 207.46.130.149 

80 202.139.16.45 
63450 207.46.130.149 
80 202.139.16.45 
80 202.139.16.45 
80 202.139.16.45 
63450 207.46.130.149 
80 202.139.16.45 
80 202.139.16.45 
63450 207.46.130.149 

80 202,139.16.45 
63450 207.46.130.149 
63450 207.46.130.149 
63450 207.46.130.149 
63450 207.46.130.149 
80 202.139.16.45 
80 202.139.16.45 
80 202.139.16,45 
80 202.139.16.45 
63450 207.46.130.149 
80 202.139.16.45 



80 
63450 
80 
63450 
80 
63450 
80 
63450 
80 
80 
80 
80 
63450 
80 
63450 
63450 
63450 
80 
63450 
63450 
80 
63450 
80 
80 
80 
80 
63450 
63450 
63450 
63450 
80 
63450 



Size 



GET 
text/html 
GET 

application 
GET 

application 
GET 

application 
GET 
GET 
GET 
GET 
Image/gif 
GET 
image/gif 
image/gif 
image/gif 
GET 
image/gif 
image/gif 
GET 
image/gif 
GET 
GET 
GET 
GET 
image/gif 
image/gif 
image/gif 
image/gif 
GET 
imaae/gif 





Timestamp 


40 


14:57:46 


19019 


14:57:47 


66 


14:57:48 


18768 


14:57:49 


71 


14:57:50 


2941 


14:57:50 


70 


14:57:50 


2812 


14:57:51 


75 


14:57:51 


72 


14:57:51 


80 


14:57:51 


73 


14:57:51 


7976 


14:57:51 


80 


14:57:52 


139 


14:57:52 


44 


14:57:52 


666 


14:57:52 


80 


14:57:52 


44 


14:57:52 


44 


14:57:52 


80 


14:57:52 


44 


14:57:52 


74 


14:57:52 


78 


14:57:53 


83 


14:57:53 


77 


14:57:53 


1348 


14:57:53 


54 


14:57:53 


3966 


14:57:53 


1883 


14:57:53 


77 


14:57:53 


1044 


14:57:54 



FIG. 6 
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r Aoaress 


Port 


1 


202.100.1 D.40 


63450 


2 


207.87.4.200 




3 


202.1oy. 1 D.40 


63450 


4 


207,87.4.205 




5 
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Site 7 Objects - Content Type "Pornography" 
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209.164.26.157 


80 


202.139.16.45 
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12:02:16 


4 


209.164.26.157 


80 


202.139.16.45 


63450 


text/html 


4211 


12:02:16 


5 


202,139.16.45 


63450 


209.164.26.157 


80 


GET 


56 


12:02:17 


6 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


290839 


12:02:17 


7 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


64 


12:02:21 


8 


209.164.26.157 


80 


202.139.16.45 


63450 


text/html 


12066 


12:02:21 


9 


202.139.16.45 


63450 


209.164.26.157 


60 


GET 


76 


12:02:22 


10 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4675 


12:02:22 


11 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:22 


12 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:22 


13 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4675 


12:02:22 


14 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4822 


12:02:22 


15 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:23 


16 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4812 


12:02:23 


17 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:23 


18 


209.164.26.157 


80 


202.139.16.45 


63450 


fmage/gif 


4824 


12:02:24 


19 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:24 


20 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4858 


1 2.:\jZ,Z^ 


21 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


1^.U^.^4 


22 


209.164.26.157 


80 


202.139,16.45 


63450 


image/gif 






23 


202.139.16.45 


63450 


209.164.26.157 


80 


Cjib 1 


f D 




24 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gu 




i p-02-24 


25 


202.139.16.45 


63450 


209.164.26.157 


80 




76 


12:02:24 


26 


209.164.26.157 


80 


202.139.16-45 


63450 


11 1 iciy c;/i-|n 


4767 


12:02:25 


27 


202.139.16-45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:25 


28 


209.164.26.157 


80 


202.139.16.45 


63450 




4732 


12:02:25 


29 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


159 


12:02:25 


30 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


159 


12:02:25 


31 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


66 


12:02:26 


32 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


43 


12:02:26 


33 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


66 


12:02:26 


34 


209.164.26.157 


80 


202-139.16.45 


63450 


image/gif 


93 


12:02:26 


35 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


66 


12:02:26 


36 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


43 


12:02:26 


37 


202.139.16-45 


63450 


209.164.26.157 


80 


GET 


66 


12:02:26 


38 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


7674 


12:02:26 


39 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


10119 


12:02:26 


40 


202.139.16.45 


63450 


209.164.26.157 


80 


GET 


76 


12:02:26 


41 


209-164.26.157 


80 


202.139.16.45 


63450 


image/gif 


4628 


12:02:26 


42 


209.164.26.157 


80 


202.139.16.45 


63450 


image/gif 


25482 


12:02:26 



FIG. 8 



wo 00/52598 



PCT/AUOO/00158 



9/9 



Population 


M 

Mean 

5900 


odel N1 
Variance 

18000 


Weiaht 

60 


Site 

1 
2 
3 
4 
5 
6 
7 


Average 

2146 
726 
1703 
666 
1937 
5149 
6561 


Std Dev 

3679 
1974 
4657 
1826 
4741 
8433 
27657 


Confidence Level 
45% 
23% 
37% 
19% 
39% 
93% 
87% 



FIG. 9 



Model N2 


Threshhold ] 






Weiaht 






20 


0.1 ! 












Site 


Text 


Graphics 


Ratio 


1 

2 
3 
4 
5 
6 
7 


20617 
6402 

25821 
1701 

19019 
9869 

19446 


25938 
68319 
54455 
67037 
17252 
102919 
696989 


o//y 

0.09 
0.47 
0.03 
1.10 
0.10 
0.03 



FIG. 10 



Model N3 


Tlireshold 


Weiqint 


30 


20 




Site 


Word Count 


1 


0 


2 


0 


3 


2 


4 


0 


5 


0 


6 


40 


7 


37 



Site 


Confidence Level 


1 


27% 


2 


34% 


3 


22% 


4 


31% 


5 


23% 


6 


96% 


7 


92% 



FIG. 11 



FIG. 12 



INTERNATIONAL SEARCH REPORT 



International application No. 
PCT/AUOO/00158 



CLASSIFICATION OF SUBJECT MATTER 



Intel.'- G06F 17/30 

According to International Patent Classification (IPC) or to both national classification and IPC 



B. 



FIELDS SEARCHED 



Minimum documentation searched (classification system followed by classification symbols) 
G06F 17/30 



Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched 



Electronic data base consulted during the international search (name of data base and, where practicable, search terms used) 
WPIL, USPTO 



C. 



DOCUMENTS CONSIDERED TO BE RELEVANT 



Category* 



Citation of document, with indication, where appropriate, of the relevant passages 



Relevant to claim No. 



P, A 



US 5867799 A (Lang et al) 2 February 1999 
Whole Document 



US 5835905 A (Pirolli et al) 10 November 1998 
Whole Document 



US 5835722 A (Bradshaw et al) 10 November 1998 



1-13 



1-13 



1-13 



X 



Further documents are listed in the continuation of Box C 



X 



See patent family annex 



* Special categories of cited documents: 

"A" document defming the general state of the art which is 

not considered to be of particular relevance 
"E" earlier application or patent but published on or after "X" 

the international filing date 
"L" document which may throw doubts on priority claim(s) 

or which is cited to establish the publication date of "Y" 

another citation or other special reason (as specified) 
"O" document referring to an oral disclosure, use, 

exhibition or other means 
"P" document published prior to the international filing 
date but later than the priority date claimed 



later document published after the international filing date or 
priority date and not in conflict with the application but cited to 
understand the principle or theory underlying the invention 
document of particular relevance; the claimed invention cannot 
be considered novel or caimot be considered to involve an 
inventive step when the document is taken alone 
document of particular relevance; the claimed invention cannot 
be considered to involve an inventive step when the document is 
combined with one or more other such documents, such 
combination being obvious to a person skilled in the art 
document member of the same patent family 



Date of the actual completion of the international search 
28 April 2000 



Date of mailing of the international search report 

- 9 MAY 2QQQ 



Name and mailing address of the ISA/AU 

AUSTRALIAN PATENT OFFICE 

PO BOX 200, WODEN ACT 2606, AUSTRALIA 

E-mail address: pct@ipaustralia.gov.au 

Facsimile No. (02) 6285 3929 



Authorized officer 

R.H. STOPFORD 

Telephone No : (02) 6283 2177 



Form PCT/ISA/210 (second sheet) (July 1998) 



INTERNATIONAL SEARCH REPORT 



International application No. 
PCT/AU00/0Q158 



C (Continuation). 



DOCUMENTS CONSmERED TO BE RELEVANT 



Category* 



Citation of document, with indication, where appropriate, of the relevant passages 



Relevant to 
claim No. 



US 5706507 A (Schloss) 6 January 1998 
Whole Document 



US 5678041 A (Baker et al) 14 October 1997 
Whole Document 



1-13 



1-13 



Form PCT/ISA/210 (continuation of Box C) (July 1998) 



INTERNATIONAL SEARCH REPORT 
Information on patent family members 



International application No. 
PCT/AUOO/00158 



This Annex lists the known "A" publication level patent family members relating to the patent documents cited in the 
above-mentioned international search report. The Austrahan Patent Office is in no way liable for these particulars 
which are merely given for the purpose of information. 



Patent Document Cited in Search 
Report 






Patent Family Member 




US 


5867799 


us 


5983214 


us 6029161 




US 


5835905 










us 


5835722 


AU 


35102/97 


WO 9750259 




us 


5706507 










us 


5678041 


CA 
JP 


2176775 
09/026975 


CN 1 145489 


EP 748095 

END OF ANNEX 



Fomi PCT/ISA/210 (citation family annex) (July 1998) 



